// Mloader (C) Adam Meyers, 2010
//
// mloader Mloader is a handy tool for dynamic malware analysis, it allows you to load a dll and specify an exported function 
//(e.g.: ServiceMain), or to create a new service with a kernel driver. This tool also supports conventional dll loading with LoadLibrary() 
// and basic process injection.

#include "stdafx.h"
#include "windows.h"

typedef VOID (WINAPI *ServiceMainFunc)(DWORD, LPSTR*); // Type Definition to allow function pointer call 

int loadDLL(char* filename) // Conventional DLL Load using LoadLibraryA - returns 0 on success
{
  HMODULE dllhandle;
  dllhandle = LoadLibraryA(filename);
  if (dllhandle == 0)
  {
	printf("Failed to load: %s file not found, or invalid dll\n",filename);
	return 8;
  }
  
  else
  {
	  return 0;
  }
}
int loadService(char *exported, char *filename)  // Load a dll and call the speficied exported funtion - returns 0 on success
{
	HMODULE dllhandle;
	FARPROC serviceproc;
	dllhandle=LoadLibraryA(filename);
	printf("Loading DLL %s and exported function %s.\n",filename,exported);
	if (dllhandle == 0)
	{
		printf("Failed to load: %s file not found, or invalid dll\n",filename);
		return 8;
	}
	else
	{
		serviceproc = GetProcAddress(dllhandle,exported);
		if (serviceproc == 0)
		{
			printf("Failed to find suitable procaddress for %s in file %s \n",exported,filename);
			return 9;
		}
		else
		{
			((ServiceMainFunc)serviceproc)(0,0);
			return 0;
		}
	}
}

int createService(char *servname,char  *filename)  // Create a new service with a specified name and load a kernel sys driver - returns 0 on success
{
	SC_HANDLE scmanager,service;
	printf("Creating Service: %s with dll %s\n", servname, filename);
	scmanager=OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);
    if (scmanager != NULL)
	{
		service=CreateServiceA(scmanager,servname,servname,SERVICE_ALL_ACCESS,1,3,1,filename,0,0,0,0,0);
		if (service != NULL)
		{
			printf("Successfully created service named: %s with dll: %s\n",servname,filename);
			return 0;
		}
		else
		{
			printf("Failed to create service.\n");
			return 9;
		}
	}
	else 
	{ 
		printf("SC Manager failed to obtain handle.\n");
		return 8;
	}
}
int injectDLL(char *process, char *filename)  // Inject a dll into a named process - returns 0 on success
{
	LPVOID loadlibaddy, remotestring;
	PROCESS_INFORMATION procinfo;
	STARTUPINFO startupInfo;
	memset(&procinfo, 0, sizeof(procinfo));
    memset(&startupInfo, 0, sizeof(startupInfo));
    startupInfo.cb = sizeof(startupInfo);
	int err;
	// Get LoadLib Proc ADdy
	loadlibaddy =  (LPVOID)GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryA");
    if (loadlibaddy == 0)
	{
		printf("Failed to find LoadLibraryA proc address.\n");
		return 9;
	}
	// Try to get PID
	if (CreateProcessA(NULL,process,NULL,NULL,FALSE,NORMAL_PRIORITY_CLASS,NULL,NULL,(LPSTARTUPINFOA)&startupInfo,&procinfo)!= 0)
	{
		printf("Process Created: %d\n",procinfo.dwProcessId);
        remotestring = (LPVOID)VirtualAllocEx(procinfo.hProcess, NULL, strlen(filename), MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE);
        WriteProcessMemory(procinfo.hProcess, (LPVOID)remotestring, filename,strlen(filename), NULL);
        CreateRemoteThread(procinfo.hProcess, NULL, NULL, (LPTHREAD_START_ROUTINE)loadlibaddy, (LPVOID)remotestring, NULL, NULL);   
        CloseHandle(procinfo.hProcess);
		err = GetLastError();
		if ( err != 0 )
		{
			printf("Process Injection Failed.\n");
			return err;
		}
		return 0;
	}
	else
	{
		printf("Failed to create process: %s reason: %d\n",process,GetLastError());
		return 8;
	}
	// Try DLL injection
}
int main(int argc, char *argv[])
{
	int result = 999;
	if (argv[1] != NULL)
	{
		if ((strncmp(argv[1],"-l",3)== 0 &&( argc > 2)))
		{
			result = loadDLL(argv[2]);
		} 
		else if ((strncmp(argv[1],"-e",3)== 0 &&( argc > 3)))
		{
			result = loadService(argv[2],argv[3]);
		} 
		else if ((strncmp(argv[1],"-s",3) == 0) && (argc == 4))
		{ 
			if (strlen(argv[2]) <= 256)
			{
				result = createService(argv[2], argv[3]); 
			}
		}
		else if ((strncmp(argv[1],"-i",3) == 0) && (argc == 4))
		{ 
			result = injectDLL(argv[2],argv[3]);
		}
		else if ((strncmp(argv[1],"-h",3) == 0) && (argc > 1))
		{ 
			printf("\nMalware Loader version 0.1.1 - by madboo\n");
			printf("  mload.exe -h This Help Menu\n");
			printf("  mload.exe -l <target dll> -- Loads a target dll using standard LoadLibrary\n");
			printf("  mload.exe -e <export> <target dll> -- Loads a target dll and calls the \n\texported function, e.g.: StartService\n");	
			printf("  mload.exe -s <service name> <target sys> -- Creates a new service with a\n\tkernel driver \n");
			printf("  mload.exe -i <target process> <target dll> -- Attempts to inject a DLL into\n\t the specified process\n");
			result = 1;
		}
		if (result == 0)
		{
			printf("Great Success!\n");
		}
		else if (result != 1)
		{
			printf("Computer says no.\n");
		}
	}
	else 
	{ 
		printf("Usage: mload.exe -h help\n");
		return -1;
	}
}
